1. Essential authentication cookies
Our web application uses cookies on tradepanda.app and the API subdomain for authentication and request protection. Production cookies are sent over HTTPS. HttpOnly cookies cannot be read by ordinary page JavaScript.
- pg_access: short-lived HttpOnly access token, normally 15 minutes.
- pg_refresh: HttpOnly, path-scoped refresh credential, normally up to 30 days; rotation can renew its validity and logout/security actions can revoke it sooner.
- pg_csrf: a JavaScript-readable anti-forgery value used with authenticated requests; normally aligned to the refresh lifetime.
- pg_oauth_google / pg_oauth_discord: short-lived HttpOnly browser-binding cookies used during social sign-in, normally up to 10 minutes.
2. Local browser preferences
The app may save theme and dashboard-layout preferences in local storage so the workspace remembers your choices on that browser. Some internal storage keys retain historical names for compatibility. These preference entries are not intended to hold your password or session tokens. Clearing site storage removes them.
Third-party sign-in pages and hosted checkout may use their own cookies under their own policies. Loading external fonts also sends requests to the font provider even where no Trade Panda tracking cookie is set.
3. Optional tracking
We do not currently enable advertising pixels or optional marketing analytics cookies in the application. Hosting providers may process essential request, performance and security logs. If we introduce non-essential tracking that requires consent, we will provide the applicable choice before enabling it and update this notice.
4. Managing storage
Use your browser settings to inspect or remove cookies and local storage, or sign out to revoke the current session. Blocking essential cookies can prevent sign-in, social-login completion and protected actions. Private browsing may discard your session when the window closes.
For questions or privacy requests, contact support@tradepanda.app. Our Privacy Policy explains the related personal-data processing.